security.yml

name: Security and quality

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  security-and-quality:
    name: security-and-quality
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Install scanner prerequisite
        shell: bash
        run: |
          if ! command -v rg >/dev/null 2>&1; then
            sudo apt-get update
            sudo apt-get install -y ripgrep
          fi

      - name: Validate repository
        shell: bash
        run: |
          python3 scripts/validate_repo.py
          python3 scripts/validate_cases.py

      - name: Run static security checks
        shell: bash
        run: |
          bash scripts/security_scan.sh .

      - name: Build and verify skill package
        shell: bash
        run: |
          bash scripts/build_skill.sh
          python3 - <<'PY'
          from pathlib import Path
          import zipfile

          package = Path("dist/slop-cop.skill")
          assert package.is_file()

          with zipfile.ZipFile(package) as archive:
              assert "slop-cop/SKILL.md" in archive.namelist()
              assert archive.testzip() is None

          print(f"Validated {package}")
          PY